Vulnerability Name:

CVE-2018-7907 (CCN-150169)

Assigned:2018-09-19
Published:2018-09-19
Updated:2018-11-28
Summary:Some Huawei products Agassi-L09 AGS-L09C100B257CUSTC100D001, AGS-L09C170B253CUSTC170D001, AGS-L09C199B251CUSTC199D001, AGS-L09C229B003CUSTC229D001, Agassi-W09 AGS-W09C100B257CUSTC100D001, AGS-W09C128B252CUSTC128D001, AGS-W09C170B252CUSTC170D001, AGS-W09C229B251CUSTC229D001, AGS-W09C331B003CUSTC331D001, AGS-W09C794B001CUSTC794D001, Baggio2-U01A BG2-U01C100B160CUSTC100D001, BG2-U01C170B160CUSTC170D001, BG2-U01C199B162CUSTC199D001, BG2-U01C209B160CUSTC209D001, BG2-U01C333B160CUSTC333D001, Bond-AL00C Bond-AL00CC00B201, Bond-AL10B Bond-AL10BC00B201, Bond-TL10B Bond-TL10BC01B201, Bond-TL10C Bond-TL10CC01B131, Haydn-L1JB HDN-L1JC137B068, Kobe-L09A KOB-L09C100B252CUSTC100D001, KOB-L09C209B002CUSTC209D001, KOB-L09C362B001CUSTC362D001, Kobe-L09AHN KOB-L09C233B226, Kobe-W09C KOB-W09C128B251CUSTC128D001, LelandP-L22C 8.0.0.101(C675CUSTC675D2), LelandP-L22D 8.0.0.101(C675CUSTC675D2), Rhone-AL00 Rhone-AL00C00B186, Selina-L02 Selina-L02C432B153, Stanford-L09S Stanford-L09SC432B183, Toronto-AL00 Toronto-AL00C00B223, Toronto-AL00A Toronto-AL00AC00B223, Toronto-TL10 Toronto-TL10C01B223 have a sensitive information leak vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the input, successful exploitation can cause sensitive information leak.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2018-7907

Source: CONFIRM
Type: Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180919-02-smartphone-en

Source: XF
Type: UNKNOWN
huawei-cve20187907-info-disc(150169)

Source: CCN
Type: huawei-sa-20180919-02-smartphone
Sensitive Information Leak Vulnerability in Some Huawei Products

Vulnerable Configuration:Configuration 1:
  • cpe:/o:huawei:agassi-l09_firmware:ags-l09c100b257custc100d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-l09_firmware:ags-l09c170b253custc170d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-l09_firmware:ags-l09c199b251custc199d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-l09_firmware:ags-l09c229b003custc229d001:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:agassi-l09:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:huawei:agassi-w09_firmware:ags-w09c100b257custc100d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-w09_firmware:ags-w09c128b252custc128d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-w09_firmware:ags-w09c170b252custc170d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-w09_firmware:ags-w09c229b251custc229d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-w09_firmware:ags-w09c331b003custc331d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:agassi-w09_firmware:ags-w09c794b001custc794d001:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:agassi-w09:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:huawei:baggio2-u01a_firmware:bg2-u01c100b160custc100d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:baggio2-u01a_firmware:bg2-u01c170b160custc170d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:baggio2-u01a_firmware:bg2-u01c199b162custc199d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:baggio2-u01a_firmware:bg2-u01c209b160custc209d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:baggio2-u01a_firmware:bg2-u01c333b160custc333d001:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:baggio2-u01a:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:huawei:bond-al00c_firmware:bond-al00cc00b201:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:bond-al00c:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:huawei:bond-al10b_firmware:bond-al10bc00b201:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:bond-al10b:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:huawei:bond-tl10b_firmware:bond-tl10bc01b201:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:bond-tl10b:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:huawei:bond-tl10c_firmware:bond-tl10cc01b131:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:bond-tl10c:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:huawei:haydn-l1jb_firmware:hdn-l1jc137b068:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:haydn-l1jb:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:huawei:kobe-l09a_firmware:kob-l09c100b252custc100d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:kobe-l09a_firmware:kob-l09c209b002custc209d001:*:*:*:*:*:*:*
  • OR cpe:/o:huawei:kobe-l09a_firmware:kob-l09c362b001custc362d001:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:kobe-l09a:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:huawei:kobe-l09ahn_firmware:kob-l09c233b226:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:kobe-l09ahn:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:huawei:kobe-w09c_firmware:kob-w09c128b251custc128d001:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:kobe-w09c:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:huawei:lelandp-l22c_firmware:8.0.0.101_c675custc675d2:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:lelandp-l22c:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:huawei:lelandp-l22d_firmware:8.0.0.101_c675custc675d2:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:lelandp-l22d:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:huawei:rhone-al00_firmware:rhone-al00c00b186:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:rhone-al00:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:huawei:selina-l02_firmware:selina-l02c432b153:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:selina-l02:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:huawei:stanford-l09s_firmware:stanford-l09sc432b183:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:stanford-l09s:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:huawei:toronto-al00_firmware:toronto-al00c00b223:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:toronto-al00:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:huawei:toronto-al00a_firmware:toronto-al00ac00b223:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:toronto-al00a:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:huawei:toronto-tl10_firmware:toronto-tl10c01b223:*:*:*:*:*:*:*
  • AND
  • cpe:/h:huawei:toronto-tl10:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    huawei agassi-l09 firmware ags-l09c100b257custc100d001
    huawei agassi-l09 firmware ags-l09c170b253custc170d001
    huawei agassi-l09 firmware ags-l09c199b251custc199d001
    huawei agassi-l09 firmware ags-l09c229b003custc229d001
    huawei agassi-l09 -
    huawei agassi-w09 firmware ags-w09c100b257custc100d001
    huawei agassi-w09 firmware ags-w09c128b252custc128d001
    huawei agassi-w09 firmware ags-w09c170b252custc170d001
    huawei agassi-w09 firmware ags-w09c229b251custc229d001
    huawei agassi-w09 firmware ags-w09c331b003custc331d001
    huawei agassi-w09 firmware ags-w09c794b001custc794d001
    huawei agassi-w09 -
    huawei baggio2-u01a firmware bg2-u01c100b160custc100d001
    huawei baggio2-u01a firmware bg2-u01c170b160custc170d001
    huawei baggio2-u01a firmware bg2-u01c199b162custc199d001
    huawei baggio2-u01a firmware bg2-u01c209b160custc209d001
    huawei baggio2-u01a firmware bg2-u01c333b160custc333d001
    huawei baggio2-u01a -
    huawei bond-al00c firmware bond-al00cc00b201
    huawei bond-al00c -
    huawei bond-al10b firmware bond-al10bc00b201
    huawei bond-al10b -
    huawei bond-tl10b firmware bond-tl10bc01b201
    huawei bond-tl10b -
    huawei bond-tl10c firmware bond-tl10cc01b131
    huawei bond-tl10c -
    huawei haydn-l1jb firmware hdn-l1jc137b068
    huawei haydn-l1jb -
    huawei kobe-l09a firmware kob-l09c100b252custc100d001
    huawei kobe-l09a firmware kob-l09c209b002custc209d001
    huawei kobe-l09a firmware kob-l09c362b001custc362d001
    huawei kobe-l09a -
    huawei kobe-l09ahn firmware kob-l09c233b226
    huawei kobe-l09ahn -
    huawei kobe-w09c firmware kob-w09c128b251custc128d001
    huawei kobe-w09c -
    huawei lelandp-l22c firmware 8.0.0.101_c675custc675d2
    huawei lelandp-l22c -
    huawei lelandp-l22d firmware 8.0.0.101_c675custc675d2
    huawei lelandp-l22d -
    huawei rhone-al00 firmware rhone-al00c00b186
    huawei rhone-al00 -
    huawei selina-l02 firmware selina-l02c432b153
    huawei selina-l02 -
    huawei stanford-l09s firmware stanford-l09sc432b183
    huawei stanford-l09s -
    huawei toronto-al00 firmware toronto-al00c00b223
    huawei toronto-al00 -
    huawei toronto-al00a firmware toronto-al00ac00b223
    huawei toronto-al00a -
    huawei toronto-tl10 firmware toronto-tl10c01b223
    huawei toronto-tl10 -